tfMITRE ATT&CK sub-technique

Exfiltration Over Bluetooth T1011.001

sub-technique of T1011 Exfiltration Over Other Network Medium

Tactic: Exfiltration
Platforms: Linux, macOS, Windows
Version: 1.2
Created: 09 March 2020
Last modified: 24 October 2025

Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Exfiltration Over Bluetooth MITRE reference T1011.001

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

FlameS0143 ↗

Has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.1

created 2017-05-31MALWARE

All 1 software entries for this technique

Offense vs defense T1011.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Exfiltration Over Bluetooth detection strategy DET0554

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Bluetooth-Based Data Exfiltration

Enterprise

3 platforms

AN1531 · Windows

Detection of non-interactive or suspicious processes accessing Bluetooth interfaces and transmitting outbound traffic following file access or staging activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Connection CreationDC0082	WinEventLog:System	EventCode=8001

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Defines how quickly a file access and Bluetooth activity must occur to be correlated.
InterfaceType	May focus on Bluetooth-specific interfaces or drivers like 'bthport.sys'.
FileSizeThreshold	Tune to trigger only on significant exfiltratable file reads.

AN1532 · Linux

Use of hcitool, bluetoothctl, or rfcomm to initialize Bluetooth connection paired with recent file reads by the same user or session.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	linux:osquery	None
Command ExecutionDC0064	auditd:SYSCALL	None
Network Connection CreationDC0082	linux:syslog	None

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BluetoothUtility	List of CLI tools to monitor (e.g., hcitool, rfcomm, obexftp).
SessionWindow	Amount of time after interface config a file must be accessed to be linked.

AN1533 · macOS

Observation of blueutil/networksetup commands or low-level APIs toggling Bluetooth or initiating transfers, especially if paired with recent large file read activity by non-GUI processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File AccessDC0055	macos:osquery	None
Command ExecutionDC0064	macos:unifiedlog	None
Network Connection CreationDC0082	macos:osquery	None

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessContext	Limit to background processes or scripts with no GUI interaction.
PayloadType	Focus on specific sensitive file types (e.g., zip, docx, keychain db).

Exfiltration Over Bluetooth detections T1011.001

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs